Skip to content

Commit d29b689

Browse files
zeripathwxiaoguang
andauthored
Ensure complexity, minlength and ispwned are checked on password setting (#18005)
It appears that there are several places that password length, complexity and ispwned are not currently been checked when changing passwords. This PR adds these. Fix #17977 Signed-off-by: Andrew Thornton <[email protected]> Co-authored-by: wxiaoguang <[email protected]>
1 parent dab28c7 commit d29b689

File tree

3 files changed

+25
-1
lines changed

3 files changed

+25
-1
lines changed

cmd/admin.go

+4
Original file line numberDiff line numberDiff line change
@@ -379,6 +379,10 @@ func runChangePassword(c *cli.Context) error {
379379
if err := initDB(ctx); err != nil {
380380
return err
381381
}
382+
if len(c.String("password")) < setting.MinPasswordLength {
383+
return fmt.Errorf("Password is not long enough. Needs to be at least %d", setting.MinPasswordLength)
384+
}
385+
382386
if !pwd.IsComplexEnough(c.String("password")) {
383387
return errors.New("Password does not meet complexity requirements")
384388
}

routers/api/v1/admin/user.go

+5
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"code.gitea.io/gitea/modules/convert"
2121
"code.gitea.io/gitea/modules/log"
2222
"code.gitea.io/gitea/modules/password"
23+
"code.gitea.io/gitea/modules/setting"
2324
api "code.gitea.io/gitea/modules/structs"
2425
"code.gitea.io/gitea/modules/web"
2526
"code.gitea.io/gitea/routers/api/v1/user"
@@ -173,6 +174,10 @@ func EditUser(ctx *context.APIContext) {
173174
}
174175

175176
if len(form.Password) != 0 {
177+
if len(form.Password) < setting.MinPasswordLength {
178+
ctx.Error(http.StatusBadRequest, "PasswordTooShort", fmt.Errorf("password must be at least %d characters", setting.MinPasswordLength))
179+
return
180+
}
176181
if !password.IsComplexEnough(form.Password) {
177182
err := errors.New("PasswordComplexity")
178183
ctx.Error(http.StatusBadRequest, "PasswordComplexity", err)

routers/web/user/auth.go

+16-1
Original file line numberDiff line numberDiff line change
@@ -1873,8 +1873,23 @@ func MustChangePasswordPost(ctx *context.Context) {
18731873
ctx.RenderWithErr(ctx.Tr("auth.password_too_short", setting.MinPasswordLength), tplMustChangePassword, &form)
18741874
return
18751875
}
1876+
if !password.IsComplexEnough(form.Password) {
1877+
ctx.Data["Err_Password"] = true
1878+
ctx.RenderWithErr(password.BuildComplexityError(ctx), tplMustChangePassword, &form)
1879+
return
1880+
}
1881+
pwned, err := password.IsPwned(ctx, form.Password)
1882+
if pwned {
1883+
ctx.Data["Err_Password"] = true
1884+
errMsg := ctx.Tr("auth.password_pwned")
1885+
if err != nil {
1886+
log.Error(err.Error())
1887+
errMsg = ctx.Tr("auth.password_pwned_err")
1888+
}
1889+
ctx.RenderWithErr(errMsg, tplMustChangePassword, &form)
1890+
return
1891+
}
18761892

1877-
var err error
18781893
if err = u.SetPassword(form.Password); err != nil {
18791894
ctx.ServerError("UpdateUser", err)
18801895
return

0 commit comments

Comments
 (0)